Search This Blog

Thursday, April 05, 2012

A useful lesson as to why the EU shouldn't decide who has access to our phone and internet records

So, the Coalition seems to have backed down on imposing new powers over internet surveillance, opting for a 'consultation' on draft plans, rather than pushing for a full Bill.

Although the exact proposals remain unclear, the Coalition seemed to be gearing up to extend the current rules on the retention of and access to communications data (the destination of phone calls, emails and websites visited, but not their content, is already recorded and stored for 12 months by UK law).

So what's the EU angle, because invariably there is one?

The requirement for service providers to retain this data are laid down in the EU's 2006 Data Retention Directive. We looked at the Directive and various other surveillance-type EU proposals in this report in 2009. But it should be noted that the previous UK Government was a co-sponsor of the initial EU proposal when it was first tabled in 2004 and, following the 2005 London bombings, was a strong supporter of the rules.

The Coalition's new proposals, which it seems likely to continue pushing after this storm has died down, would use additional UK legislation to extend the data collected to cover contacts made via social networking, and potentially even online video games. But, arguably the most controversial proposal is to allow intelligence officers to access emails, calls and texts as they happen in 'real time', without a warrant, rather than retrospectively.

This all goes beyond the current EU Data Retention Directive, which is basically limited to the retention of data on landline calls, mobile calls, emails and web history. The current Directive also leaves it up to member states to decide how and when law enforcement authorities can gain access to this data. So don't blame the EU in other words.

But this is not necessarily the end of the story. The European Commission plans to make a proposal for an amended Data Retention Directive this year.

And crucially, the Commission's 2011 evaluation of the current Directive stated that:

The Commission will assess the need for, and options for achieving, a greater degree of harmonisation with respect to the authorities having and the procedure for obtaining access to retained data. Options might include more clearly defined lists of competent authorities, independent and/or judicial oversight of requests for data and a minimum standard of procedures for operators to allow access to competent authorities.

In other words, law enforcement authorities' access to retained communications data could be something that will be regulated by the EU in future, if the Commission opts for this approach and gets support from member states and MEPs.

What this would mean for the UK in practice is not entirely clear because the UK is often rather more keen on state snooping than other EU states (e.g. Germany, which doesn't implement the original directive after its Constitutional Court struck it down). It is therefore unlikely that the EU minimum standard for law enforcement access to data would go beyond current UK practice or what the Coalition is trying to do in future.

However, this week's media storm over how much access the state has to our personal data shows that the principle of allowing the EU to determine which authorities have access to our personal data, and when, could create huge political issues in the future. How would politicians like to tell their voters that in fact it is the EU that decides on who and how police forces can access their data?

One thing that this week has surely taught us is that this is something that should be decided nationally, where if the one government decides to make authoritarian assaults on civil liberties they can at least be overturned by future governments or rethought due to public pressure. Not so once an EU directive is in place and it requires the re-opening and successful conclusion of negotiations between 27 member states and 736 MEPs.

It will interesting to see, following this week's storm in Britain, what the Commission will propose.

What this does teach us is that when the UK government comes up with a cool new idea, you will often find the EU lurking behind. They announce the UK version first so we think it is a local idea and that the EU is following us. Like the new 80mph speed limit (to fit in with the European 130kph limit), like HS2 (to fit in with the European strategy on public transport).